The connector page says Connected . The collector VM is running. The Azure Monitor Agent (AMA) is installed. And CommonSecurityLog is as empty as an office on a Friday afternoon. Or worse, every event shows up twice.

Rebuilt in my lab tenant with made-up data, checked against Microsoft Learn (October 2026). My lab: an Ubuntu log collector called LAB-SYSLOG-01 in resource group rg-lab-sentinel , a Contoso workspace, and test messages from a made-up LabFirewall ( 10.0.0.x addresses). In the screenshots, machine names, accounts, paths and workspace names are masked.

TL;DR

A CEF message passes six stops: device, port 514, syslog daemon, AMA on local port 28330, data collection rule (DCR), workspace. "No data" means one hop is broken. Test them one at a time.

Send your own test message with logger before you blame the firewall.…